Ubuntu Server Administration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where Ubuntu Server sits

Ubuntu Server is a Debian-family distribution with its own release cadence, its own packages, and netplan as the usual network front end. apt installs software. A sudo-capable user is the normal first admin. The hostname, that user, and SSH are the first hour. The provisioning guide is the file that can build this for you. This page is what you check after it boots.

Current Ubuntu Server images expect network configuration in netplan YAML under /etc/netplan, then netplan apply. A static lab address looks like 192.0.2.10/24 with gateway 192.0.2.1, and you replace both before the host leaves the lab. Do not paste an interfaces file from a Debian guide and assume netplan is not in charge.

ufw is common and not always installed. firewalld is not the Ubuntu default. SELinux is not the Ubuntu default. AppArmor may be present. Do not disable a confinement tool to make a package start. Find which profile is complaining.

Upgrades between Ubuntu releases use the release tool Ubuntu documents, on a host you can reinstall, after a backup. They are not apt upgrade with a new repository added by hand in the same window.

The first hour on a lab host

Step 1 on Ubuntu Server covers the hostname. Set the hostname to edge-01 and confirm hostnamectl or the hostname command prints it. Inventory and logs use this name. A cloned image with the old name is a second host pretending to be the first. The check is: The ticket name and the command agree. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Ubuntu Server draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 2 on Ubuntu Server covers the admin user. Use the named sudo user the installer created. Give that user a key. Do not work as root over SSH. Ubuntu's installer expects a sudo user. Root SSH is the hardening guide's later no. The check is: sudo works for that user, and the key login works. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Ubuntu Server draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 3 on Ubuntu Server covers the address. Put 192.0.2.10/24 and gateway 192.0.2.1 in netplan only as a lab. Run netplan apply with a console open. The wrong interface name in YAML drops the session. The console is the rollback. The check is: The address on the interface matches the ticket, and SSH still works. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Ubuntu Server draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 4 on Ubuntu Server covers updates. apt update, read the list, then upgrade from Ubuntu's own repositories. A third-party repository is a different decision. The check is: apt reports the host is current enough for the lab, and you wrote down the version. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Ubuntu Server draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 5 on Ubuntu Server covers one service. Enable only the service this host is for, after its own guide says how. A host that enables everything in the first hour has no purpose. The check is: systemctl status for that one service is the line you keep. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Ubuntu Server draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

# Ubuntu Server lab. Review before you paste.
# Network is netplan, not a Debian interfaces file.
# Lab address 192.0.2.10/24 via 192.0.2.1. Replace before production.
# User is the named admin. prompt-for-this is not a password to keep.
# netplan apply only with a console open.

The commands you will actually repeat

Day to day you refresh package indexes and install from Ubuntu's repositories, then read what apt will change before you accept it. A kernel update is a reboot decision from the patch guide, not a surprise at the end of an unrelated ticket.

systemctl is how you look at services. The systemd guide is that language. Ubuntu uses it. You still do not edit a unit under /usr.

Logs are in the journal. The logging guide sets retention. A netplan apply that drops your SSH session is why the console is open first.

Unattended upgrades are a choice with a reboot policy, not a default you discover on a Monday. If they are on, the patch guide's ring still exists for everything else.

What Ubuntu Server is not

Ubuntu is not Debian stable. Package names and versions differ, and a Debian how-to can be subtly wrong. It is not RHEL, so dnf, firewalld, and SELinux commands are the wrong page.

It is not a desktop image with extra services you leave enabled. The server image is the one you meant. If you installed a desktop to get a browser on the server, undo that as its own change.

It is not finished because apt said the install completed. The admin key works, the address is the one in the ticket, and a service you enabled answers. Those are the finish line.

The hour you stop

Write the hostname, the role, and the clock time before you change Ubuntu Server. If this host is also serving users, it is not the lab and this first hour belongs on a spare. The provisioning guide is how the spare gets built. A change without a spare is a change you can still postpone.

Keep the console or the out-of-band path open for the whole hour. Reloading a network service, a firewall, or a secure-shell daemon from the only session is how a lab becomes a drive across town. The hardware guide names that path for a physical machine. A virtual machine uses the hypervisor console. A cloud instance uses the serial console the platform gives you. Test it before the reload, not after.

The address 192.0.2.10/24 and the gateway 192.0.2.1 are documentation. They belong in the lab note and nowhere else. On a real network, use the prefix the network desk already assigned. On a cloud instance, use the address the platform assigned and do not hard-code the documentation range into user-data. If a generator filled the documentation address into a production draft, delete it.

prompt-for-this is a reminder that a secret is missing. It is not a password you set, not a token you commit, and not a string you leave in a configuration file because the service started. The real secret lives in the password store. The ticket says who can read it. A file that still contains the reminder is a file you have not finished.

One service is enough for the first hour on Ubuntu Server. The purpose from the fundamentals page says which service. Every other package stays uninstalled until its own guide has a ticket. A host that enables a web server, a database, and a queue in the first hour has three changes and no proof. Finish the login, the address, and the update. Then stop.

Read the package transaction before you accept it. A count of packages is not a review. If the list contains a repository you did not add, stop. If it contains a kernel, the patch guide's reboot decision applies and the console stays open. If it contains software this role does not need, remove that line from the plan rather than installing it and disabling it later.

The previous image, the previous configuration file, or the previous package version is the rollback. Write the path down while the host still works. A rollback you invent after a failed reload is a guess. The migration guide assumes the old copy is still there. Do not delete it in the same hour to free a disk.

When the checks pass, copy the notes into the ticket and leave the host alone. The next host waits until a second person can repeat the login and the address from the notes. A fleet built from memory drifts. A fleet built from the file the provisioning guide stored stays boring, which is the point of Ubuntu Server in production.

If a step on Ubuntu Server fails twice, stop for the day. The failure is the result. Adding a forum command beside a half-applied config produces a host nobody can rebuild. Rebuild from the image instead. The time you lose is smaller than the time you will spend explaining the hybrid.

Hand the finished lab to the guide that matches the role: web, mail, storage, backup, or hardening. Ubuntu Server being installed is not the same as the role being ready. The role guide has its own proof. Do not skip it because the package manager exited without an error.

A second person reads the hostname, the address, and the rollback path aloud before you build the next host. If they cannot find those three in the ticket, the notes are not done. Silence is not agreement. The check is the sentence they repeat back.

Store the working notes next to the image version. A month from now Ubuntu Server will still boot from that pair, and the chat where you remembered a flag will be gone. The file is the memory. The host is replaceable. That is the whole point of writing this hour down.

Ubuntu Server checks before a second host

Confirm this before you call the change done: Ubuntu Server is the OS the hostname reports, not a neighbour you copied from. The lab address 192.0.2.10/24 is gone before this host is placed on a real network. prompt-for-this is not the password that was set, and no password is in the ticket. The named admin can log in with a key. The package manager used is the one this page names. A network file from a different distribution was not pasted in. The config test or the apply command for this network tool succeeded. The previous image or install file is kept. No new third-party repository was added in the first hour. A service you do not need was not enabled to see what it does. Console or out-of-band access works before you reload SSH. A second person read the hostname and the address. netplan apply was used, not an interfaces file from Debian. ufw, if you enabled it, still allows your management prefix. AppArmor was not disabled. And the release is an Ubuntu Server LTS you intend to keep, or the ticket accepts a shorter release. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.